CVE-2019-6293

An issue was discovered in the function markbeginningasnormal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the markbeginningasnormal function making recursive calls to itself in certain scenarios involving lots of '' characters. Remote attackers could leverage this...

CVE-2019-6293: Uncontrolled Recursion

An issue was discovered in the function markbeginningasnormal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the markbeginningasnormal function making recursive calls to itself in certain scenarios involving lots of '' characters. Remote attackers could leverage this...

CVE-2019-6293

CVE-2019-6293 affects the Flex package (version 2.6.4) via a stack exhaustion fault in the function mark_beginning_as_normal() within nfa.c. In scenarios with many '*' characters, recursive calls can cause denial-of-service locally or remotely depending on the deployment context, as described in ...

Flex Denial of Service Vulnerability

flex is a program for recognizing lexical patterns in text. A security vulnerability exists in the 'markbeginningasnormal' function in the nfa.c file in flex version 2.6.4. A remote attacker can exploit this vulnerability to cause a denial of service...

Brocade Fabric OS Advisory - US

Lenovo Security Advisory: LEN-24765 Potential Impact: Privilege escalation, information disclosure, denial of service Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2018-6433, CVE-2018-6434, CVE-2018-6435, CVE-2018-6436, CVE-2018-6437, CVE-2018-6438, CVE-2018-6439, CVE-2018-644...

CMM Security Concerns - Lenovo Support US

No description provided...

Security Bulletin: Vulnerabilities in cURL/libcURL affect IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru

Summary The following vulnerabilities in cURL/libcURL have been addressed by IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru. Vulnerability Details CVEID: CVE-2018-1000007 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a flaw when passing ...

Ettercap - A Comprehensive Suite For Man In The Middle Attacks

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis. ETTERCAP...

Shopify: Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass

Summary athena-flex-production.shopifycloud.com seems to be an internal system that Shopify uses because it redirects user to Okta login. During this however, I noticed that it first returns 200 and then does a redirect meaning some part of the website loads before redirecting. With this, I was...

Tamper proofing review: the iZettle card payment terminal

Tamper resistance is an increasingly important factor in smart devices. Together with secure hardware design and defensive coding, it can deliver a very secure device. One of the most common areas the average consumer will encounter tamper resistant devices is in payment terminals, or Pin Entry...

Adobe ColdFusion DataServicesCFProxy Insecure Deserialization (CVE-2018-4939)

An insecure deserialization vulnerability exists in the Flex integration service of Adobe ColdFusion. The vulnerability is due to the lack of input validation. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Security Bulletin: Flex System V7000 systems are affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...

ColdFusion RCE(CVE-2018-4939)

In October 2017 I published an overview and video proof-of-concept of a Java RMI/deserialization vulnerability affecting the Flex Integration service of Adobe ColdFusion. I held off on publishing all of the details and exploit code at the time because I spotted an additional exploit payload that...

Security Bulletin: A vulnerability in libxml2 affects IBM Flex System Manager (FSM) (CVE-2017-16932)

Summary A vulnerability has been identified in libxml2 that is embedded in FSM. This bulletin addresses that issue. Vulnerability Details CVEID: CVE-2017-16932 DESCRIPTION: Xmlsoft libxml2 is vulnerable to a denial of service, caused by an infinite recursion issue in parameter entities. By sendin...

Security Bulletin: Multiple vulnerabilities in apache2 affect IBM Flex System Manager (FSM)

Summary Multiple vulnerabilities have been identified in apache2 that is embedded in the FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3167 DESCRIPTION: Apache HTTPD could allow a remote attacker to bypass security restrictions, caused by the use of the...

Security Bulletin: Multiple vulnerabilities in unzip affect IBM Flex System Manager (FSM)

Summary Multiple vulnerabilities have been identified in unzip that is embedded in the FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2016-9844 DESCRIPTION: Info-Zip UnZip is vulnerable to a denial of service, caused by buffer overflow in zishort function in...

Security Bulletin: Multiple vulnerabilities in glibc affect IBM Flex System Manager (FSM) (CVE-2017-15671, CVE-2017-15670)

Summary Multiple vulnerabilities have been identified in glibc that is embedded in the FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2017-15671 DESCRIPTION: GNU C Library is vulnerable to a denial of service, caused by a memory leak in the glob function in...

Security Bulletin: Multiple vulnerabilities in freetype2 affect IBM Flex System Manager (FSM)

Summary Multiple vulnerabilities have been identified in freetype2 that is embedded in the FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2017-8287 DESCRIPTION: Freetype2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Flex System Manager (FSM)

Summary Multiple vulnerabilities have been identified in OpenSSL that is embedded in the FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3735 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error while...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.6 and 1.7 that is used by FSM. These issues were disclosed as part of the IBM Java SDK updates in October 2017. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2017-10345...